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This listing of claims will replace all prior versions, and 
listings, of claims in the application. 

Listing of Claims : 

Claim 1 (previously presented) : A method of detecting 
states that are activated by a computer unit, in order to 
detect an unauthorized behavior or an unauthorized software 
program, the method comprising: 

checking a set of values in a memory area of the 
computer unit or in a proprietary file stored within the 
computer unit, with each set of values correspond to a 
state activated by the computer unit, wherein the checking 
includes calculating a maximum base count for entries in a 
defined registry segment; and 

capturing each set of values to determine each state 
activated by the computer unit. 

Claim 2 (Original) : The method of claim 2 wherein the 
checking the set of values comprises: 

initiating a parallel registry segment thread. 

Claim 3 (Original) : The method of claim 2 wherein the 
initiating the parallel registry segment thread comprises: 
collecting registry data. 

Claim 4 (Original) : The method of claim 1 wherein the 
checking the set of values comprises: 

initiating a parallel operating system segment thread. 
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Claim 5 (Original) : The method of claim 4 wherein the 
initiating the parallel operating system segment thread 
comprises : 

analyzing at least one of an operating system 
directory structure, ''root" and all directories and sub- 
directories . 

Claim 6 (Original) : The method of claim 1 wherein the 
checking the set of values comprises: 

initiating a parallel third party segment thread. 

Claim 7 (Original) : The method of 6 wherein the initiating 
the parallel third party segment thread comprises: 

scanning all third party start up files and all 
initialization files . 

Claim 8 (Original) : The method of claim 1 wherein the 
checking the set of values comprises: 
initiating a polling thread. 

Claim 9 (Original) : The method of claim 8 wherein the 
initiating the polling thread comprises: 

loading configuration data into memory. 

Claim 10 (Original) : The method of claim 8 wherein the 
initiating the polling thread comprises: 

loading stored directory configuration data to memory. 

Claim 11 (Original) : The method of claim 8 wherein the 
initiating the polling thread comprises: 

loading a third party start up information into 
memory. 
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Claim 12 (Original) : The method of claim 8 wherein the 
initiating the polling comprises: 

detecting for an unauthorized modification. 

Claim 13 (Original) : The method of claim 1 further 
comprising : 

transmitting each set of values to a remote computing 

unit . 

Claim 14 (previously presented) : An article of 
manufacture, comprising : 

a machine-readable medium having stored thereon 
instructions to: 

check a set of values in a memory area of the computer 
unit or in a proprietary file stored within the computer 
unit, with each set of values correspond to a state 
activated by the computer unit, wherein the checking 
includes calculating a maximum base count for entries in a 
defined registry segment; and 

capture each set of values to determine each state 
activated by the computer unit. 

Claim 15 (previously presented) : An apparatus for 
detecting states that are activated by a computer unit, in 
order to detect an unauthorized behavior or an unauthorized 
software program, the apparatus comprising: 

means for checking a set of values in a memory area of 
the computer unit or in a proprietary file stored within 
the computer unit, with each set of values correspond to a 
state activated by the computer unit, wherein the checking 
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includes calculating a maximum base count for entries in a 
defined registry segment; and 

communicatively coupled to the checking means, means 
for capturing each set of values to determine each state 
activated by the computer unit. 

Claim 15 (Original) : An apparatus for detecting states 
that are activated by a computer unit, the apparatus 
comprising: 

means for checking a set of values in a memory area of 
the computer unit or in a proprietary file within stored 
within the computer unit, with each set of values 
correspond to a state activated by the computer unit; and 

communicatively coupled to the checking means, means 
for capturing each set of values to determine each state 
activated by the computer unit. 

Claim 16-39 (Canceled) 
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